# Cloud organization role access

This guide documents the approved cloud organization hierarchy as it exists today.

## Scope

Organization roles authorize access inside one cloud workspace. They are separate from platform Den admin access: platform Den admins are allowlisted operators for Den admin routes and the den-admin MCP surface, and organization `owner` or `super-admin` roles do not grant that platform access.

Den Web controls enforce policy in the client by hiding or disabling actions, and Den API endpoints enforce policy by rejecting unauthorized requests. UI disabling is not security enforcement; route guards and handler checks are the security boundary. Settings reads and writes are checked separately, and OpenWork Models is an operational Models surface outside Settings.

## Built-in hierarchy

The built-in organization roles are ordered:

1. `owner`
2. `super-admin`
3. `admin`
4. `member`

`owner` satisfies every organization gate. `super-admin` satisfies super-admin and admin gates. `admin` satisfies admin gates. `member` satisfies member gates only.

Organizations may have multiple `super-admin` and `admin` members. Each organization has exactly one protected `owner`; the owner role cannot be assigned through invitations or member role changes, and the owner member cannot be removed.

## Ownership transfer

Only the current `owner` can transfer ownership. The target must be an active `super-admin`. After transfer, the target becomes the sole `owner` and the previous owner becomes `super-admin`.

## Den Web sidebar

For cloud organization admins (`owner`, `super-admin`, and `admin`), the Den Web sidebar order is:

- Dashboard
- Your Connections, when enabled
- Extensions
  - Marketplace
  - Sources
  - Plugins
  - Connectors
- Models
  - OpenWork Models
  - LLM Providers
- Members
- Analytics
- Settings
  - General
  - Diagnostics
  - Brand appearance
  - Desktop Policies
  - Stripe
  - API Keys
  - SSO
  - SCIM

Plain members have member access only: Dashboard, plus Your Connections when that capability is enabled.

## Role matrix

| Access or operation | `owner` | `super-admin` | `admin` | `member` |
| --- | --- | --- | --- | --- |
| Member-level workspace access | Yes | Yes | Yes | Yes |
| Operational mutation outside Settings | Yes | Yes | Yes | No |
| Settings visibility and reads | Yes | Yes | Yes, read-only | No in Den Web |
| Settings writes | Yes | Yes | No | No |
| Member role changes | Yes, except owner | Yes, except owner | No | No |
| Invitations | Invite assignable non-owner roles | Invite assignable non-owner roles | Invite `member` only | No |
| Removals | Remove non-owner members | Remove non-owner members | Remove non-owner members | No |
| Ownership transfer | Yes, to active `super-admin` | No | No | No |

The owner is the only undeletable member role. Admins can invite members and remove non-owner members, but cannot promote or demote members, write Settings, or invite elevated roles.

## Custom roles

Custom roles can add delegated permissions where the Den API supports them, but they do not replace the built-in hierarchy. Built-in role names are protected, the owner role remains transfer-only, and the highest built-in role in a member's role string controls owner/super-admin/admin/member gates.